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IN THE f XAIMS : 

Please amend the claims as follows: 

1 • (Cuirently Amended) A method of automatically identifying anomalous situations during 
system operations, said method comprising: 

recording features of normal system n^f,*™ rationo porformcd by a system as 
features in a history file; 

automatically creating a model for each ofsaid featur es of said normal system onerst.,-.™ 
only from normal data in said history file; 

determining by calculating anomaly scores ofsaid features ofsaid normal svstpm 
operations and storing said anomaly scores in tn r rn,Wr. a trained file; 

establishing a threshold to evaluate whether events in live system op erations fln > 
anomalies as compared to said normal system gp giations featees nr - nm 1 : 

automatically identifying abnormal actions anomalous events in a ^saiH live system 
operations based on said anomaly scores and on said threshold; 

reporting said anomalous events : and 

periodically repeating said calculating determining, whoroui said abnormal actions 
i ndicate anomalous situations during Qj'stcm operati o n . 

2. (Currently Amended) The method in claim I, wherein said creating said model for jjIJ 
each feature comprises: 



establishing relationships that exist between eachof said eaefe features £* ofsaid normal 
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system operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

3. (Original) The method in claim 2, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

4. (Original) The method in claim 2, wherein said normal system operations comprise said 
features in said history file at the time said models are created. 

5. (Currently Amended) The method in claim 1, wherein said determining calculating 
comprises: 

predicting a likelihood that said each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
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features. 



6. (Original) The method in claim 5, wherein said trained file provides an normally score 
for each of said features for each of a plurality of different possible abnormalities. 

7. (Currently Amended) The method in claim 5, wherein said automatically identifying 
a bnormal actions comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said feature s of said 
given operation: 

comparing said anomaly score for each of said features of said given op eration with sa id 
threshold to determine whether each anomaly score exceeds said threshold. 

8. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations, said method comprising: 

recording features of normal system operations actions performed by a synt o m ao features 
in a history file; 

automatically creating a model for each ofsajd features only from normal data of said 
normal system operations in said history file; 

detonniningby calculating anomaly scores of said features of said normal system 
operations and storing said anamolv scores In tn pgeduee a trained file; 

establishing a threshold to evaluate whether events in live system operations are 
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anomalies as compared to said normal syjtgrg ^ r,^ feafcses n r r 1 nn , . ,,. 

automatically identifying i bnormaj actions anomalous events in e £said live system 
operatiohsb ased on said anomaly scores and on said threshold: 

reporting s aid anomalous event : and 

periodically repeating said calculating d etermining, wherein said abnormal actions 
m dicato anomalous situations during system operation ; 

wherein said creating of said model for each of said eaeb features comprises: 

establishing relationships that exist between eachof said eaeh features for say 
normal system operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said 
labeled feature to create a solution for said labeled feature, wherein said solution comprises a 
model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

9. (Original) The method in claim S, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

10. (Original) The method in claim 8, wherein said normal system operations comprise said 
10/658,623 * 
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features in said history file at the time said models are created. 

1 1 . (Currently Amended) The method in claim 8, wherein said d e termining calculating 
comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 



12. (Original) The method in claim 1 1 , wherein said trained file provides an normally score 
for each of said features for each of a plurality of different possible abnormalities. 

13. (Currently Amended) The method in claim 11, wherein said automatically identifying 
abnormal actions comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said feature s of said 
given operation; 

comparing said anomaly score for each of said features of said given op eration with said 
threshold to determine whether each anomaly score exceeds said threshold. 
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14. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations, said method comprising: 

recording features of normal system operations .rtinnr perfeaaed by a T:tcm as 
features in a history file; 

automatically creating a mode! for each ofsaid features of said normal svst.n, p^fe 
o iuy from normal data in said history file; 

Calculating anomaly scores of said features ofsaid normal s vstemn n nm ti«n C * n H 
storing said anomaly scores inu^a^^. a trained file; 

establishing a threshold to evaluate whether events in live system op erations are 
. anomalies as compared to said normal sy s tem operations fentnrr^ m nhn^ -l - 

automatically identifying abnormal notions anomalous events in ]j vc system 

operations based on said anomaly scores and onjsaid threshold: 

reporting said anomalous events: and 

periodically repeating said peculating d e termining, whoroin said abnormal actions 
indicate annmnlmir. rinmti,-^ ^ ir i n ^ 5 y 3 t c m operati o n^ 
wherein said Gaining calculating c omprises- 

predicting a likelihood that each feature will be normal when one or more of the 
other features are abnormal, using said model of each ofsaid features; 

repeating said predicting using different presumptions about other features being 
normal and abnormal to produce said trained file of a plurality of anomaly scores for each ofsaid 
features. 
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15. (Currently Amended) The method in claim 14, wherein said creating said model for cadi 
said foatue e comprises: 

establishing relationships that exist between each of said e** features for said normal 
system operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

16. (Original) The method in claim 15, wherein said solution comprises a mathematical 
statement of what said labeled feature equals in terms of the relationships between the remaining 
features. 

17. (Original) The method in claim 15, wherein said normal system operations comprise said 
features in said history file at the time said models are created. 



18. (Original) The method in claim 14, wherein said trained file provides anormally 
for each of said features for each of a plurality of different possible abnormalities. 



score 
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1 9. (Cuirently Amended) The method in claim 14, wherein said automatically identifying 
abnormal actions comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said features of said 
given operation; 

comparing said anomaly score for each of said features of said given ona^rion v uiih sa id 
threshold to determine whether each anomaly score exceeds said threshold. 

20. (Currently Amended) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform a method of 
automatically identifying anomalous situations during system operations, said method 
comprising: 

recording features of normal system optratinng actions performed by a 03'gtcm eg 
features in a history file; 

automatically creating a model for each ofsajd_featur es of said normal system 
only from normal data in said history file; 

performing training by calculating anomaly scores of said eaefe feature s of said normal 
system operations and st oring said anomaly scores in a fil P; 

establishing a threshold to evaluate whether events in live system operations gg 
an omalies as compared to said normal , Y «t» m operations fHtnrrr irr nhnnimnl. 

automatically identifying abnormal action* anomalous ev«nt« m live system 

Operations based on said anomaly scores and on said threshold^ 
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reporting said anomalous events! and 

periodically repeating said calculating determining wlmcin said abnormal acli uu j 
indicate anomalous situations during oystom operotiono . 

21 . (Currently Amended) The program storage device in claim 20, wherein paid method 
Author comprises a proc B aa of creating a model for said oach feature comprises: 

establishing relationships that exist between each of said eaefe features for sajdnormal 
system operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises a model for 
said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

22. (Original) The program storage device in claim 21, wherein said method further 
comprises a mathematical statement of what said labeled feature equals in terms of the 
relationships between the remaining features. 

23. (Original) The program storage device in claim 21, wherein said normal system 
10/658,623 10 
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operations comprise said features in said history file at the time said models are created. 

24. (Currently Amended) The program storage device in claim 20, wherein said calculating 
r e arrangin g-further comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 

25. (Original) The program storage device in claim 24, wherein said trained file provides an 
normally score for each of said features for each of a plurality of different possible abnormalities. 

26. (Currently Amended) The program storage device in claim 24, wherein said 
automatically identifying a bnormal actions further comprises: 

determining values of said features for a given operation of said system; 
referring to said trained file to retrieve and anomaly score for each of said feature s of said 
given operation; 

comparing said anomaly score for each of said features of said given op eratic ™tu sa i d 
threshold to determine whether each anomaly score exceeds said threshold. 
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